Jump to content
This Topic

Mirage Islands in ORAS

MichiS97

By MichiS97
in Saves - Research

 Share

Recommended Posts

theSLAYER

theSLAYER

Posted
Posted
  suloku said:
Great! I'm gonna quote IGN:

"Only one random Mirage Spot can be discovered within your own game each day, but up to ten more can be sent over via StreetPass or Passerbys on the Player Search System."

I had previously read you coul unlock all spots, seems I was fooled. Don't know why they added two padding bytes, but seems we won't get anything else from streetpass.

But seems we almost cracked the spots, only piece remaining would be 0x1600 and TID, since that spot is the only one with hidden items, but maybe hacking in the mirage spot just for the hidden item is quite pointless, as since you are hacking the spot just for the hidden it, you might hack the item

yeah with the ability to hack, the items are easily obtainable.

Of course, I am a bit curious though.

Manipulating the bytes at those addresses, we may be able to find some sort of list, and 1600 probably ends at that list too.

Yeah, I thought the padded bytes was weird as hell too, and the weird 16 that appeared infront didn't make sense.

Furthermore, when I didn't use padded bytes, nothing appeared..

So if we write those bytes on a save file that didn't receive streetpasses and is zerorized, and it works, then its confirmed!

  • Replies 105
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Popular Posts

suloku
suloku

I tested this on the C app I put toguether the other day, and it outputs crescent island. I will try this in-game later. Edit: @the_SLAYER I tested on my savefile those values and crescent isle appea

suloku
suloku

I tried several times to port the code reversed by Falo to c#, but it's too complicated to my current understanding of variables and how each language handles all the shifts and other operations, so I

MichiS97
MichiS97

Finally remembered to test this! Works like a charm!

suloku

suloku

Posted
Posted

I'm pretty sure they go bay map# except crescent isle being the first instead of the last.

Back to padding... I think it is padded due to being a "decrypted" version of what lies at 0x1600.

Now we know the output for crescent isle is 01 00 00 000 and have these TID/0x1600 combos for it:

TID 00000: FF FF FE FF

TID 61931: 76 CC C9 91

Edit: also, my tid&0x91C9 = 0x91C9, which seems suspicious but we'd need anither save with crescent isle as dayly spot to see if this is mere coincidence (I don'tthink so...)

Of course now endianess and maybe using the low/high bytes might come at play if 0x1600 is an encrypted u32 with the TID (an u16). FF FF FE FF unlocking the isle suggests the value are two u16 (I may be wrong though).

Also, for things like this I recall GF using a modulus, here's what they did in swarms for DP (also check the safari formula): https://projectpokemon.org/wiki/Pokémon_DP_Save_File_Structure#Swarm_Pok.C3.A9mon_-_0x72D4

I made some tests, they are in this order:

  Reveal hidden contents
theSLAYER

theSLAYER

Posted
Posted (edited)

I was assuming TID will have an operation with the Mirage Daily Value, then end off with p % 33 (akin to how Nature was determined against PID)

Too bad this scenario only worked with one of the values:

(Lower half xor higher half xor TID) -> 0xFFFE xor 0xFFFF xor 0x0000 = 0x0001 (crescent isle).

However I was unable to replicate this with the second pair

0x91C9 xor 0x91C9 xor 0xCC76 -> 0xCC76 -> 52342 (in decimal)-> 42 (last 2 digits) -> (minus until it is in scale) 42-33 = 9 incorrect

It's also not this:

(TID xor Mirage Daily value) % 33 = ( 23999 xor 0 ) % 33 -> 59 % 99 -> 33 incorrect

I also tried:

[(vMDV + ^MDV) xor TID ] % 33 = [(0x91C9 + 0xCC76) xor 0x91C9] % 33 -> (0x15E3F xor 0x91C9) % 33 -> 0x1CFF6 % 33 -> 118774 % 33 -> 8 incorrect

We know at the very least, the relationship with TID isn't divide, 'cos that will cause everything to go to shit.

Actually, if we can figure out why TID 0 and MDV 0 goes to map 465 (ID 20), we'll solve the mystery.

perhaps we should or 20 somewhere?

(edit: apparently your TID is 0xF1EB, why was I using 0x91C9?)

Edited by theSLAYER
MichiS97

MichiS97

Posted
  • Author
Posted
  suloku said:
Great! I'm gonna quote IGN:

"Only one random Mirage Spot can be discovered within your own game each day, but up to ten more can be sent over via StreetPass or Passerbys on the Player Search System."

I had previously read you coul unlock all spots, seems I was fooled. Don't know why they added two padding bytes, but seems we won't get anything else from streetpass.

But seems we almost cracked the spots, only piece remaining would be 0x1600 and TID, since that spot is the only one with hidden items, but maybe hacking in the mirage spot just for the hidden item is quite pointless, as since you are hacking the spot just for the hidden it, you might hack the item

I'm not really sure if IGN is right on this one. I'm pretty sure you can unlock all islands on a single day with streetpass

theSLAYER

theSLAYER

Posted
Posted
  MichiS97 said:
I'm not really sure if IGN is right on this one. I'm pretty sure you can unlock all islands on a single day with streetpass

We figured out that one address (which is a raw value that needs to be cracked; its related to TID) that determines own island,

and determined 10 other addresses that determined passed islands,

and haven't been able to activate more than 10 passed spots at a time. :/

Writing values into the padded areas between the 10 addresses may cause the island to not even activate..

suloku

suloku

Posted
Posted (edited)

Well, you may test by enabling 11 islands (10 hexed + daily), then streetpass with a oras save that has a daily spot that isn't any of the other 11.

But if that was the case, there's no reason you couldn't unlock all spots via online pss, just leave the console there and eventually you have the 32 other spots? Makes sense they limited it to 10+1 daily, to keep the luck factor, or getting crescent isle would be too easy

EDIT: You are right about deciphering tid and dmv outputing 0x20. For reference, FF FF FF FE also produces 0x20 with tid 0.

EDIT 2: I've been thinking, and since we know (or suspect) the output, seeing what 00000000 and TID 1 produces might help. Also, if it works like passed spots, the output can't be 0, so maybe it is adding +1 after the calculus, or it can't output 0 at all.

Edited by suloku
theSLAYER

theSLAYER

Posted
Posted

Technically final output 0 is 33.

33 - 33 is 0, so it only -33 if result >33.

Thing is, I don't see how xor operations against 0 TID Wil result in 0x20

I haven't been able to figure how they determine mirage spot based on raw MDV

At least we got streetpassed ones working..

suloku

suloku

Posted
Posted

Maybe it is modulus 32 -> value range 0-32 (33 possible values) + 1.

But as you said, being able to edit the passed spots in batches of 10 is great. Maybe we could even make an ntr plugin to eaaily change the first passed island, the values are near the eon ticket "herpesvalue" so it should be easy to find on a memory dump.

Guest

Guest

Posted
Posted

Speaking of NTR plugins, is a plugin that changes the 3DS's clock while in-game something that could be done?

Or if NTR can do that, would it still trigger the anti-time-travel mechanisms? Figured that if the game remained powered on while the change occured, that it might not notice the jump.

Kinda surprised nobody tried to make a homebrew raw rtc changer though. Kinda lame to be restricted to a dev app that could be hard to find :P and I'd have thought that demands for anti-time-travel bypass would have been higher.

suloku

suloku

Posted
Posted

Well, the anti timetravel, for what I know, stores the difference between real clock and raw rtc. I guess we could calcuñate the value and search it in a savegame, the the plugin would fix the value in the save bwfore loading, but for what I saw ctrulib doesn't have the functions to tingle rtc (either real or raw).

I guess we are stuck to the dev app. The little demand is because only a few game have anti-timetravel.

Also, tested TID 1 and 0x1600 zeroed, output was map 197 (0x0f if the output should be the same as streetpass)

suloku

suloku

Posted
Posted

I coded this really quick, should be user friendly enough:

https://github.com/suloku/gen6_safari_mirage_tool/releases/tag/0.1

It also has the friend safari unlock for XY :D

By the way, when coding it I realized that the u32 value at 0x1600 (MDV) is the only thing that get's checksummed in the whole block, unless I trusted the wiki too much, because I haven't really tested the tool on my 3DS, I just saw changes were correctly made with an hex editor.

Falo

Falo

Posted
Posted

Block 5 (0x1600) is Savedata::RandomGroup

this block is just a 4 byte random value, which is generated by the 3DS AES engine.

I didn't fully reverse it, but it calls SVC 0x28 "GetSystemTick(void)" and then uses a Mersenne Twister algo with sha256 and sha1 hash.

So it's not encrypted, just a random value. It's like a seed value from the good old RNG days.

suloku

suloku

Posted
Posted
  Falo said:
Block 5 (0x1600) is Savedata::RandomGroup

this block is just a 4 byte random value, which is generated by the 3DS AES engine.

I didn't fully reverse it, but it calls SVC 0x28 "GetSystemTick(void)" and then uses a Mersenne Twister algo with sha256 and sha1 hash.

So it's not encrypted, just a random value. It's like a seed value from the good old RNG days.

Thanks for the info about how it is generated! The "problem" we have is that we haven't been able to figure out the algorythm that the game uses to output the Daily Mirage Spot. We know the algorythm uses this random value and TID, but the algorythm isn't simple enough to guess it without reverse engineering (something I don't have a clue how to do).

Falo

Falo

Posted
Posted
  suloku said:
Thanks for the info about how it is generated! The "problem" we have is that we haven't been able to figure out the algorythm that the game uses to output the Daily Mirage Spot. We know the algorythm uses this random value and TID, but the algorythm isn't simple enough to guess it without reverse engineering (something I don't have a clue how to do).

The code for this can be found in DllSkyTrip.cro and the code.bin, function to generate mirage spot: ".text:004608F4 sub_4608F4"

To find the current Mirage Spot, it uses that random value, and some other values, like the current time and generates a new random value.

the final result of it is then "rnd % 33 + 1".

suloku

suloku

Posted
Posted
  Falo said:
The code for this can be found in DllSkyTrip.cro and the code.bin, function to generate mirage spot: ".text:004608F4 sub_4608F4"

To find the current Mirage Spot, it uses that random value, and some other values, like the current time and generates a new random value.

the final result of it is then "rnd % 33 + 1".

So that's what we were missing! Would it be very difficult to get the full asm for the function? I don't know how to get it, but I can probably get the asm into a friendlier C (well, I suppose if you can get the asm you are most than capable of also translating it to C).

Also, is it really the current time? the_SLAYER and me got the same islands just by setting the random seed to certain values with TID being 0, that's why we assumed it only used those two. Did we just get unfortunate coincidence?

edit: should I just get the code.bin into IDA and look for the function you posted? Does it work that way? (I really have no clue)

theSLAYER

theSLAYER

Posted
Posted
  suloku said:
So that's what we were missing! Would it be very difficult to get the full asm for the function? I don't know how to get it, but I can probably get the asm into a friendlier C (well, I suppose if you can get the asm you are most than capable of also translating it to C).

Also, is it really the current time? the_SLAYER and me got the same islands just by setting the random seed to certain values with TID being 0, that's why we assumed it only used those two. Did we just get unfortunate coincidence?

edit: should I just get the code.bin into IDA and look for the function you posted? Does it work that way? (I really have no clue)

current time was probably used as a seed to generate the value,

but I think the list value shifts based on TID.

Falo

Falo

Posted
Posted
  theSLAYER said:
current time was probably used as a seed to generate the value,

but I think the list value shifts based on TID.

Yes but it's still a random value:

 

unsigned int __fastcall sub_4608F4(int a1, int a2){ _DWORD *savePtr; // r4@1 int trainerId; // r6@1 unsigned int rnd; // r0@1 int rnd_ctx; // [sp+0h] [bp-28h]@1 char ctx; // [sp+10h] [bp-18h]@1 savePtr = *(_DWORD **)(sub_14E348() + 28); trainerId = *(_DWORD *)(*savePtr + 0x129A8); init_rnc_ctx((int)&ctx); j_getGameTime(savePtr, (int)&ctx); j_gfl2::math::Random::Initialize((int)&rnd_ctx, *(_DWORD *)(*savePtr + 0x1048) + trainerId); rnd = j_MersenneTwister((int)&rnd_ctx); *(_WORD *)(a1 + 0x51DA) = rnd % 33 + 1; return rnd % 33 + 1;}

 

//*(_DWORD *)(*savePtr + 0x1048) = the random value from SaveData::RandomGroup

theSLAYER

theSLAYER

Posted
Posted
  Falo said:
Yes but it's still a random value:

 

unsigned int __fastcall sub_4608F4(int a1, int a2){ _DWORD *savePtr; // r4@1 int trainerId; // r6@1 unsigned int rnd; // r0@1 int rnd_ctx; // [sp+0h] [bp-28h]@1 char ctx; // [sp+10h] [bp-18h]@1 savePtr = *(_DWORD **)(sub_14E348() + 28); trainerId = *(_DWORD *)(*savePtr + 0x129A8); init_rnc_ctx((int)&ctx); j_getGameTime(savePtr, (int)&ctx); j_gfl2::math::Random::Initialize((int)&rnd_ctx, *(_DWORD *)(*savePtr + 0x1048) + trainerId); rnd = j_MersenneTwister((int)&rnd_ctx); *(_WORD *)(a1 + 0x51DA) = rnd % 33 + 1; return rnd % 33 + 1;}

 

//*(_DWORD *)(*savePtr + 0x1048) = the random value from SaveData::RandomGroup

It's okay being a random value,

as long as a spread from 1-33 can be calculated, it is cool!

suloku

suloku

Posted
Posted

I'm a bit confused, I seem to understand that the SaveData::RandomGroup and TID are used to initialize the MersenneTwister algorythm for generating a random value that is used to calculate the daily spot, but I fail to see the role that these play:

init_rnc_ctx((int)&ctx);

j_getGameTime(savePtr, (int)&ctx);

rnd_ctx

I've looked at some MersenneTwister implementations and none seem to have an input argument beside getting it seeded, unlike this call j_MersenneTwister((int)&rnd_ctx).

Just to clarify, the goal I'm after is to make a function such as this:

 

u32 RandomGroup_MDV (u16 TID, u8 MirageSpot){  u32 randomgroup = 0;  for (randomgroup = 0; randomgroup < 0xFFFFFFFF; i++)  {     //Algorythm that uses randomgroup and TID to generate a value between 1-33 (yes, I know you just posted the algorythm the game uses)     if (result == MirageSpot)       break;       }  return randomgroup;}

 

Falo

Falo

Posted
Posted

It was just a quick analysis,

init_rtc_ctx initializes a 8 byte structure

this is then used by j_getGameTime, i'm not sure if it "gets" or "sets" the time, since "get" makes more sense i used that name.

savePtr is a pointer to the Savedata:: Savedata structure, not the raw save.

gfl2::math::Random::Initialize, the name comes from the sun&moon demo, not oras,

this initializes a mersenne twister algo, here the rest of the functions: (pseudo c code)

  Reveal hidden contents

I found the algo online, it's "Tiny Mersenne Twister"

https://gitlab-dev.in2p3.fr/SOPHYA/SophyaLib/blob/927c275e1bbe27c728119b9763ef174ece43fc47/BaseTools/tinymt32.c

https://gitlab-dev.in2p3.fr/SOPHYA/SophyaLib/blob/927c275e1bbe27c728119b9763ef174ece43fc47/BaseTools/tinymt32.h

suloku

suloku

Posted
Posted
  Falo said:
It was just a quick analysis,

init_rtc_ctx initializes a 8 byte structure

this is then used by j_getGameTime, i'm not sure if it "gets" or "sets" the time, since "get" makes more sense i used that name.

savePtr is a pointer to the Savedata:: Savedata structure, not the raw save.

gfl2::math::Random::Initialize, the name comes from the sun&moon demo, not oras,

this initializes a mersenne twister algo, here the rest of the functions: (pseudo c code)

  Reveal hidden contents

I found the algo online, it's "Tiny Mersenne Twister"

https://gitlab-dev.in2p3.fr/SOPHYA/SophyaLib/blob/927c275e1bbe27c728119b9763ef174ece43fc47/BaseTools/tinymt32.c

https://gitlab-dev.in2p3.fr/SOPHYA/SophyaLib/blob/927c275e1bbe27c728119b9763ef174ece43fc47/BaseTools/tinymt32.h

Thank you very much for the functions! With this I can generate values for any given TID and Mirage Spot. I need to test in game, but seems it will work. I don't know what the time call does there, doesn't seem to impact the mirage spot in any way.

If someone wants to test, this should produce cresscent isle:

TID: 12345 (this is in decimal!)

0x1600: 3C 1C 12 91 (this is direct hex view!)

BlackShark

BlackShark

Posted
Posted
  suloku said:
If someone wants to test, this should produce cresscent isle:

TID: 12345 (this is in decimal!)

0x1600: 3C 1C 12 91 (this is direct hex view!)

Didn't work for me.

Do I just have to edit my TID and the value at 0x1600, or is there something else I'm missing?

By the way, nice work guys!

theSLAYER

theSLAYER

Posted
Posted
  BlackShark said:
Didn't work for me.

Do I just have to edit my TID and the value at 0x1600, or is there something else I'm missing?

By the way, nice work guys!

Edit TID, change the value, fix checksums, and inject the save,

it should change and load Crescent Isle.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing
×
×
  • Create New...